For many modern communication systems, the reliability and security of exchanged information is a significant concern. To address this concern, the Trusted Computing Platform Alliance (TCPA) developed security solutions for platforms. In accordance with a TCPA specification entitled “Main Specification Version 1.1b,” published on or around Feb. 22, 2002, each personal computer (PC) is implemented with a trusted hardware device referred to as a Trusted Platform Module (TPM). Each TPM contains a unique endorsement key pair (EK), which features a public EK key (PUBEK) and a private EK key (PRIVEK). The TPM typically has a certificate for the PUBEK signed by the manufacturer.
During operation, an outside party (referred to as a “verifier”) may require authentication of the TPM. This creates two opposing security concerns. First, the verifier needs to be sure that requested authentication information is really coming from a valid TPM. Second, an owner of a PC including the TPM wants to maintain as much privacy as possible. In particular, the owner of the PC wants to be able to provide authentication information to different verifiers without those verifiers being able to determine that the authentication information is coming from the same TPM.
One proposed solution to these security issues is to establish a Trusted Third Party (TTP). For instance, the TPM would create an Attestation Identify Key pair (AIK), namely a public AIK key and a private AIK key. The public AIK key could be placed in a certificate request signed with the PRIVEK, and subsequently sent to the TTP. The certificate for the PUBEK would also be sent to the TTP. Once the certificates are received, the TTP would check that the signed certificate request is valid, and if valid, the TTP would issue a certificate to the TPM.
Once a certificate is issued, the TPM would then use the public AIK and the TTP issued certificate when the TPM received a request from a verifier. Since the AIK and certificate would be unrelated to the EK, the verifier would get no information about the identity of the TPM or PC implemented with the TPM. In practice, the above-identified approach is problematic because it requires TTPs to be established. Identifying and establishing various parties that can serve as TTPs has proven to be a substantial obstacle.
Another proposed solution is set forth in a co-pending U.S. application Ser. No. 10/306,336, filed Nov. 27, 2002, which is also owned by the assignee of the present application. The proposed solution utilizes a direct proof method whereby the TPM could prove directly (without requiring a trusted third party) that an AIK has been created by a valid TPM without revealing the identity of the TPM. In that solution, each TPM has a unique private key. Unfortunately, an adversary may take a TPM and, using sophisticated means, extract the unique private key from the TPM.
In the Direct Proof method, there is a method given to be able to revoke a key that has been removed from a TPM. During the Direct Proof protocol, the TPM gets a base, h, and computes and reveals k=hf mod n, where n is part of the public key, and f is part of the unique key held by the TPM. So if a verifier receives a value f0 that has been removed from a TPM, the verifier can check whether the Direct Proof was created using this value f0, by performing the computation k0=hf0 mod n, and checking to see if k=k0. For if k=k0, then the Direct Proof was created using f0, and if k is not equal to k0, then the Direct Proof was created using some other private key.
One limitation of this method is that it requires that the verifier obtain the value of f0. It is conceivable that the adversary could have obtained the secret unique value from a TPM, and used it in a way that the verifier could not obtain the value of f0, but could know that for a particular k0, that value of f0 had been removed from the TPM. In U.S. application Ser. No. 10/306,336, one method was presented for dealing with this problem. It required the verifier to provide the value of the base h for each TPM to use when interacting with that verifier. This has the property that it allows the verifier to be able to link all interactions with that verifier.